OpenAI says an automated pipeline running an upcoming cyber security model found 948 distinct Linux kernel bugs that let someone who already has a foothold on a machine take full “root” control, and produced working exploits for them. In a run in mid-October costing about $1.2m in API credits, the system flagged 2,308 candidate flaws and reproduced 1,724 of them. The figures come from OpenAI’s own research post, published on 4 November, and have not yet been checked by outside experts; OpenAI is keeping the technical details private.
OpenAI says it has sent hundreds of reports and patches for critical flaws to the kernel’s maintainers and will release fixes for the rest in stages with partners in its Patch the Planet initiative. Not all of the bugs are fixed yet.
Linux runs most of the world’s servers and cloud machines, and its kernel sits inside Android phones. Each of these bugs needs an attacker who is already on the system, so the risk is highest on shared machines and those running code from others. The bigger point is cost: if AI makes finding such flaws this cheap, defenders have less time between discovery and attack.
What to do: keep kernel updates current and apply distribution updates promptly over the coming months, and isolate untrusted workloads with sandboxes or lightweight virtual machines.
Source: OpenAI